Switch Sha256 to using bitcoin_hashes and our own HKDF